feat: add video OCR/ASR, DOCX/PDF export, input block and risk config updates

- Video pipeline: video file OCR via VLM plus audio track ASR, integrated
  into job_handlers with progress emit per phase. New media_utils.py for
  audio extraction from video files.
- Document export: richExport.js replaces inline docx builder; DOCX and PDF
  export buttons are now enabled in MilkdownEditor. File size limit raised to
  100 MB.
- Input block: new InputBlockCrepe.vue component with inputBlockPlugin.ts
  and inputBlock.js for custom user-input nodes in the editor.
- Risk config: added Vite dev server ports (5173) to CORS allowlist and
  increased OCR max input from 10 MB to 100 MB.
- TTS/ASR refactor: simplified tts_asr.py model loading and warmup logic.
- Test coverage: updated tests for llm, main endpoints, pro completions and
  web search modules.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/tests/test_web_search.py

@@ -17,6 +17,7 @@ if str(BACKEND_DIR) not in sys.path:
 
 import job_handlers  # type: ignore
 import job_system  # type: ignore
+import llm  # type: ignore
 import risk_control  # type: ignore
 import session_store  # type: ignore
 import audit_store  # type: ignore
@@ -55,10 +56,14 @@ def test_web_search_route_returns_done(monkeypatch):
             return {"content": '["vector database comparison", "pinecone weaviate qdrant"]'}
         if tag.endswith("-webu"):
             return {"content": '["https://example.com/a", "https://example.com/b"]'}
-        if tag.endswith("-webf"):
-            return {"content": "第一段\n\n第二段"}
         raise AssertionError(f"unexpected tag: {tag}")
 
+    async def fake_stream_ollama_events(prompt, system_prompt=None, tag="", **kwargs):  # noqa: ARG001
+        if not tag.endswith("-webf"):
+            raise AssertionError(f"unexpected stream tag: {tag}")
+        yield "content", "第一段\n\n"
+        yield "content", "第二段"
+
     async def fake_searxng_search(query, *, limit):  # noqa: ARG001
         return [
             {
@@ -83,6 +88,7 @@ def test_web_search_route_returns_done(monkeypatch):
     monkeypatch.setattr(job_handlers, "call_ollama", fake_call_ollama)
     monkeypatch.setattr(job_handlers, "_searxng_search", fake_searxng_search)
     monkeypatch.setattr(job_handlers, "_firecrawl_scrape", fake_firecrawl_scrape)
+    monkeypatch.setattr(llm, "stream_ollama_events", fake_stream_ollama_events)
 
     with TestClient(main.app) as client:
         with client.stream("POST", "/v1/web-search", headers=HEADERS, json=_payload()) as resp: